The present invention relates to computer network security, and more particularly, but not exclusively, relates to protection from denial of service attacks caused by initiating, but not completing a number of spurious connections through the Internet.
Concomitant with the development of computer networks, schemes to degrade or defeat operation of such networks have been devised. In response, a host of techniques have been proposed to improve network security. U.S. Pat. No. 5,884,025 to Baehr et al.; U.S. Pat. No. 5,842,040 to Hughes et al.; U.S. Pat. No. 5,826,014 to Coley et al.; U.S. Pat. No. 5,822,434 to Caronni et al.; U.S. Pat. No. 5,604,803 to Aziz; U.S. Pat. No. 5,511,122 to Atkinson; and U.S. Pat. No. 5,481,611 to Owens et al. are cited as sources of additional background information regarding various attempts to improve network security.
One particular type of attack monopolizes available network resources in such a manner that legitimate users are denied service. This type of xe2x80x9cdenial of service attackxe2x80x9d has been recognized in various contexts. One especially troublesome denial of service attack for Internet Protocol (IP) based networks is called xe2x80x9cSYN flooding.xe2x80x9d SYN flooding arises when an attacker sends many Transmission Control Protocol (TCP) connection requests, each initiated with a xe2x80x9cSYNchronizexe2x80x9d (also called SYN) packet, to a victim""s machine. Each request causes the targeted host to instantiate data structures out of a limited pool of resources; however, because the source address for each of these SYN packets is illegitimate or xe2x80x9cspoofed,xe2x80x9d completion of a proper connection is impossible. Consequently, the limited resources of the targeted host are quickly used up in response to the spurious SYN packets so that no more incoming TCP connections can be establishedxe2x80x94thus denying further legitimate access. The SYN flooding attack exploits weaknesses with TCP/IP (Transmission Control Protocol/Internet Protocol) that cannot be corrected without significant protocol modifications. Moreover, this type of denial of service attack can be launched with little effort, and is difficult to trace back to its originator.
As a result, there is a need for protective techniques that reduce, if not eliminate, the impact of denial of service attacks, such as SYN flooding.
One form of the present invention includes a unique computer network monitoring technique. A further form of the present invention includes a unique defense for denial of service attacks.
In another form of the present invention, network messages passing to one or more hosts from an untrusted network are actively monitored. Suspect messages are identified. The behavior of each suspect message is tracked in terms of a number of conditionally coupled states to determine whether any of the suspect messages present a security threat requiring action.
In yet another form, network messages may be classified into one or more other categories besides the suspect category. By way of nonlimiting example, TCP packets may be categorized as having an unacceptable source address, suspect source address, or acceptable source address.
In an additional form, host resources allocated in response to connection initiation requests from an untrusted network are released by monitoring such requests, determining which requests are unacceptable or suspect, and selectively sending a command that changes the status of such requests from the perspective of the hosts. In one nonlimiting example, host resources dedicated to incomplete TCP connections that are quickly saturated by suspect SYN packets may be released by sending ACKnowledge packets (also called ACK packets) corresponding to the SYN packets. In another nonlimiting example, host resources may be relieved by closing spurious connections through transmission of a ReSeT packet (also called a RST packet).
In still another form, a technique of the present invention includes detecting a number of SYN packets sent from an untrusted network to a destination host to regulate spurious connection attempts. The corresponding source address of each SYN packet is classified in one of a plurality of different categories, the categories including a suspect source address category and an unacceptable source address category. TCP packet behavior is monitored for each address classified in the suspect source address category with a state machine process including at least three different conditionally coupled states, and a RST packet is sent to the destination host for any address classified in the unacceptable source address category.
Accordingly, it is one object of the present invention to provide a unique computer network monitoring technique.
It is another object of the present invention to provide a unique defense for denial of service attacks.